This website uses cookies. By continuing to browse or login to this website, you consent to the use of cookies. Learn more.
OK
gaurav10_02
Cadet 3rd Class
Cadet 3rd Class
‎2014-01-05 12:35
424 views

Flex Connector error "File Processing ended : Failure", not able to parse logs.

I am a beginner to ArcSight. I have written a flexconnector for variable format logs. I am getting logs FTPed in a directory. Now when I deployed my connector it seems everything has gone fine at my point. But when I created a channel for my connector in ArcSight Manager console I am getting only following alerts:

Connector Raw Event Statistics

File processing started

File processing ended: Failure

Connector Raw Event Statistics

File processing started

File processing ended: Failure

Connector Raw Event Statistics

File processing started

File processing ended: Failure

Connector Raw Event Statistics

File processing started

File processing ended: Failure....

It seems my flex connector is trying to parse the log file but due to some error failing.

Can anyone please help me out in this issue how to troubleshoot the issue. How can I get to know what is the error?

Is there any way to troubleshoot or debug my parser. Is this something related to my parser or log file or some configuration.

Labels (2)
Preview file
67 KB
0 Likes
Reply
Report Inappropriate Content
1 Reply
Ahedge
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class
‎2014-01-05 20:06

The problem is probably in your agent.properties parameters.  There is a parameter in that file that will tell ArcSight to start parsing at the beginning or end of the file.  In your case this should probably be set to false, so that once the file is received the Connector will process the entire file.

agents[0].foldertable[0].startatend=false

The agent.log file is the place where most of the information is located telling what the connector is doing.

0 Likes
Reply
Report Inappropriate Content
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.